@substrat-run/control-plane-api 0.178.0 → 0.179.0

package/dist/api.js

@@ -14,7 +14,7 @@ import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { abandonCopy, beginTransfer, connectionGrantsForScope, transferScope, isScopeNotHeld, notHeldIsBenign } from './vertical-client.js';
 import { COPY_JOB_MAX_MS, copyJobAt, copyJobHeld, copyJobId, copyJobLive, copyTagId, versionIdOfOrder, versionOrderOf, } from './copy-job.js';
-import { runningVersionOf, runningVersionStoresOf, scopeStoreReachOf, scopeStoresOf, unrouteScope } from './platform-scope-stores.js';
+import { exportStoreDumps, runningVersionOf, runningVersionStoresOf, scopeStoreReachOf, scopeStoresOf, unrouteScope } from './platform-scope-stores.js';
 import { liveApprovalOf } from './store-script.js';
 import { STORE_REBUILD_REQUEST_SUBREQUESTS, runStoreFleetRebuild, storeRebuildBudget, storeRebuildStatus } from './store-rebuild.js';
 import { PUSH_HOLD_TTL_MS, STORE_RELEASE_STORED_MAX_BYTES, approveStoredDriverRelease, readStoreDriverApprovals, runStoreDriverRevoke, runStoreDriverRollout, storeDriverRelease, storedReleaseLoader } from './store-releases.js';
@@ -68,6 +68,8 @@ import { mintPushToken, pushActorFor } from './push-token.js';
 import { TENANT_SERIES_SCOPE_CAP, REQUEST_FACET_KEYS, LOGS_INCOMPLETE_HEADER } from './observability.js';
 import { parseTenantRequestQuery, parseTenantWindowQuery, refineTenantWindow, refuseSearchOnCounts, parseTenantLineQuery, REQUEST_WHERE_VALUES_MAX, scriptFamiliesOfScopes, } from './tenant-request-query.js';
 import { namespacesForScript } from './do-namespaces.js';
+import { discardMoves, moveStores } from './store-move.js';
+import { backupEnds, commitStages, inlineStoreSource, restoreEnds, snapshotEnds, StoreLandFailure, storeHoldsRows, } from './store-move-ends.js';
 import { backupDirectoryIfDue } from './directory-backup.js';
 import { deployedDoClasses, platformSweeperDecision } from './platform-entry.js';
 import { extractedMigrationsDigest, extractedMigrationsProblem, extractedMigrationsRefusal, MigrationExtractionError, MigrationLoaderUnavailable, } from './migration-extract.js';
@@ -1016,7 +1018,7 @@ export function createControlPlaneApi(options) {
     /** `substrat.wipe` on each declared store, before the scope's own bytes go. */
     const wipePlatformStores = async (c, scope) => (await platformStoresWipe(c, scope))();
     /**
-     * A dump in pages (`substrat.export-page`) of each store the lifecycle reaches, for a backup, a full pull or a fork.
+     * The stores a backup, a full pull or a fork copies: those the scope's running version declares.
      *
      * A dump is only worth taking if it restores, and a restore imports only what the destination's
      * version declares (L8). So a binding only an earlier version declared (#2286) is left out of the
@@ -1025,24 +1027,29 @@ export function createControlPlaneApi(options) {
      * way out, rather than produce a dump its own scope could not restore. Wipe, reap and erasure
      * never export, so they reach such a store regardless.
      */
-    const exportPlatformStores = async (c, scope) => {
+    const platformStoreReach = async (c, scope) => {
         const caller = options.platformScopeStores;
         if (!caller || !scope.vertical)
             return undefined;
         const { running, all } = await scopeStoreReachOf(c.var.admin, c.get('actor'), scope, options.storeDrivers);
         if (all.length === 0)
             return undefined;
-        const exported = await caller.exportStores({ tenantId: scope.tenantId, scopeId: scope.id, vertical: scope.vertical, stores: all });
+        const place = { tenantId: scope.tenantId, scopeId: scope.id, vertical: scope.vertical };
         const current = new Set(running.map((store) => store.binding));
-        const dropped = exported.filter((store) => !current.has(store.binding));
-        const held = dropped.find((store) => store.tables.some((table) => table.rows.length > 0));
-        if (held) {
-            throw new ControlPlaneError(409, `scope ${scope.id}'s store '${held.binding}' was declared by an earlier version of '${scope.vertical}' and ` +
+        for (const dropped of all.filter((store) => !current.has(store.binding))) {
+            if (!(await storeHoldsRows(caller, place, dropped)))
+                continue;
+            throw new ControlPlaneError(409, `scope ${scope.id}'s store '${dropped.binding}' was declared by an earlier version of '${scope.vertical}' and ` +
                 `still holds data, and the version the scope runs does not declare it, so a dump of it could not be ` +
-                `restored. Declare '${held.binding}' as a '${held.driver}' again in a version the scope runs, then export; ` +
+                `restored. Declare '${dropped.binding}' as a '${dropped.driver}' again in a version the scope runs, then export; ` +
                 `or reap the scope without a backup, which wipes it`);
         }
-        return exported.filter((store) => current.has(store.binding));
+        return { caller, place, stores: running };
+    };
+    /** The stores a pull or a tenant export answers inline, each read whole (`exportStoreDumps`). */
+    const exportPlatformStores = async (c, scope) => {
+        const reach = await platformStoreReach(c, scope);
+        return reach && exportStoreDumps(reach.caller, reach.place, reach.stores);
     };
     /**
      * `substrat.erase` on the destination's stores for each subject tombstoned in the destination
@@ -1264,13 +1271,23 @@ export function createControlPlaneApi(options) {
         // #977: a tenant credential minted for a person writes through a view that names
         // them on every admin row. Only the credential's own claim can supply the person —
         // never a header or a body — and only the staff mint writes that claim.
-        const view = principal.kind === 'tenant' && principal.onBehalfOf && host.attributed
-            ? host.attributed(principal.onBehalfOf)
-            : host;
+        const view = viewOf(principal);
         c.set('host', view);
         c.set('admin', view.admin);
         await next();
     });
+    /**
+     * #977: the host a principal's request writes through — the attributed view for a tenant
+     * credential minted for a person, the configured host otherwise. The middleware sets it on
+     * the request; a helper handed only the principal derives the same view here (#2860), so its
+     * access rows name the person too.
+     */
+    function viewOf(principal) {
+        return principal.kind === 'tenant' && principal.onBehalfOf && host.attributed
+            ? host.attributed(principal.onBehalfOf)
+            : host;
+    }
+    const adminFor = (principal) => viewOf(principal).admin;
     // Confine a BUILDER to the vertical-management surface, fail-CLOSED (builder-plane.md
     // §4). Default-deny by design: a builder reaches only the routes on this allowlist,
     // and only for verticals its tenant owns (the per-route ownership checks below). A
@@ -1547,7 +1564,7 @@ export function createControlPlaneApi(options) {
             const vertical = await resolveVerticalId(c, raw);
             const owner = (pathTenant ?? confined)
                 ? null
-                : ((await verticalOf(c.get('actor'), vertical))?.ownerTenant ?? null);
+                : ((await verticalOf(c.var.admin, c.get('actor'), vertical))?.ownerTenant ?? null);
             return { vertical, tenantId: pathTenant ?? confined ?? owner };
         }
         catch {
@@ -2949,7 +2966,7 @@ export function createControlPlaneApi(options) {
         resolveVertical: options.resolveVertical,
         resolveVerticalVersion: options.resolveVerticalVersion,
         resolveVerticalRef: options.resolveVerticalRef,
-        ownerOf,
+        ownerOf: (actor, slug) => ownerOf(c.var.admin, actor, slug),
         tenantSlugOf: async (actor, tenantId) => (await c.var.admin.getTenant(actor, tenantId).catch(() => null))?.slug ?? null,
     }, c.get('actor'), scope);
     /**
@@ -2964,11 +2981,11 @@ export function createControlPlaneApi(options) {
      * exact split so it is a seconds-long diagnosis, not a multi-hour hunt. A couple of
      * directory reads only when a call has already failed to resolve.
      */
-    const diagnoseUnboundScope = async (actor, scope) => {
+    const diagnoseUnboundScope = async (admin, actor, scope) => {
         const slug = scope.vertical;
         if (!slug)
             return 'scope has no vertical bound — nothing to deliver to';
-        const versions = await host.admin.listVersions(actor, slug).catch(() => []);
+        const versions = await admin.listVersions(actor, slug).catch(() => []);
         const boundId = scope.verticalVersionId;
         if (boundId && !versions.some((v) => v.id === boundId)) {
             return (`scope is bound to version '${boundId}', which is not among vertical '${slug}'’s ${versions.length} ` +
@@ -2981,7 +2998,7 @@ export function createControlPlaneApi(options) {
                 `pushes are on different slugs (a lineage fork). Push under '${slug}' by setting \`substrat.slug\`, ` +
                 `or rebind the install to the slug the versions live under.`);
         }
-        const serving = await host.admin.verticalServing(actor, slug).catch(() => null);
+        const serving = await admin.verticalServing(actor, slug).catch(() => null);
         if (!serving) {
             return `vertical '${slug}' has ${versions.length} version(s) but none is promoted to a serving channel — promote one to prod.`;
         }
@@ -2995,10 +3012,10 @@ export function createControlPlaneApi(options) {
      * `servingRef` is the route the scope takes in the same act (an adopt). The host's read also
      * refuses, whatever is acknowledged, a move that strands people a link bound (#2178).
      */
-    const refuseOnBreaks = async (actor, tenantId, scopeId, versionId, opts) => {
+    const refuseOnBreaks = async (admin, actor, tenantId, scopeId, versionId, opts) => {
         // Asked even when acknowledged: the read also refuses a move that strands people a link
         // bound (#2178), which no acknowledgement passes.
-        const breaks = await host.admin.bindingImpact(actor, tenantId, scopeId, versionId, opts.servingRef !== undefined ? { servingRef: opts.servingRef } : undefined);
+        const breaks = await admin.bindingImpact(actor, tenantId, scopeId, versionId, opts.servingRef !== undefined ? { servingRef: opts.servingRef } : undefined);
         if (opts.acknowledge?.exportBreak)
             return;
         if (breaks.length > 0)
@@ -3030,7 +3047,7 @@ export function createControlPlaneApi(options) {
      * as it stood before the failed attempt. Every caller still re-asserts after it (the
      * fallback), passing what this reports.
      */
-    const restoreCarryingSwitches = async (actor, dest, tenantId, scopeId, tables, 
+    const restoreCarryingSwitches = async (admin, actor, dest, tenantId, scopeId, tables, 
     /** #1869: the scope `tables` were captured from — `scopeId` itself unless the copy moves —
      *  and `exact` when the platform exported them itself rather than a caller supplying them.
      *  #1722: `loadStamp`, the stamp a carry leaves on the copy it lands, and `expect`, the marker
@@ -3040,10 +3057,10 @@ export function createControlPlaneApi(options) {
         // the destination is not primary, the vertical marks it a copy in its own storage — a carry
         // of a copy made before every copy carried the marker brings none, and a CP-less host reads
         // the marker for primacy. Idempotent there; an install is never marked.
-        const rec = await host.admin.getScopeRecord(actor, tenantId, scopeId);
+        const rec = await admin.getScopeRecord(actor, tenantId, scopeId);
         const markCopy = rec ? copyLineageOf(rec) : undefined;
         return retryTransient(async () => dest.restoreScope(tenantId, scopeId, tables, {
-            ...(await switchCarryFor(host.admin, actor, { tenantId, scopeId })),
+            ...(await switchCarryFor(admin, actor, { tenantId, scopeId })),
             sourceScopeId: source.scopeId,
             exact: source.exact,
             loadStamp: source.loadStamp,
@@ -3077,7 +3094,7 @@ export function createControlPlaneApi(options) {
         }
         // #1756: onto the serving script, the scope runs the served version from the moment routing
         // flips — whatever its own version exported. Asked before the export below moves anything.
-        await refuseOnBreaks(actor, tenantId, scopeId, serving.versionId, {
+        await refuseOnBreaks(c.var.admin, actor, tenantId, scopeId, serving.versionId, {
             servingRef: serving.ref,
             acknowledge: opts.acknowledge,
         });
@@ -3120,7 +3137,7 @@ export function createControlPlaneApi(options) {
         const serving = await c.var.admin.verticalServing(actor, slug);
         if (!serving)
             return none; // embedded / not dispatch-backed — the host cascade handled rebinds
-        const v = await verticalOf(actor, slug);
+        const v = await verticalOf(c.var.admin, actor, slug);
         if (!v || v.ownerTenant === null || v.listed)
             return none; // private only, like the host cascade
         const owned = (await c.var.admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview');
@@ -3218,7 +3235,7 @@ export function createControlPlaneApi(options) {
         const { review, ...bindAck } = opts.acknowledge ?? {};
         // #1756: within one lineage this is an adopt, and judged as one before anything moves. A
         // crossing is not judged (`bindExportBreaksOf`): the producer's slug itself changes.
-        await refuseOnBreaks(actor, tenantId, scopeId, serving.versionId, {
+        await refuseOnBreaks(c.var.admin, actor, tenantId, scopeId, serving.versionId, {
             servingRef: serving.ref,
             acknowledge: bindAck,
         });
@@ -3324,7 +3341,7 @@ export function createControlPlaneApi(options) {
             const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, tenantId, scopeId);
             // #2450: a page at a time into the destination's stage, so a scope of any size moves.
             const { dump, loadStamp: sourceStamp, revision: sourceRevision } = await transferScope(source, dest, { from: scopeId }, { retry: retryTransient });
-            const restored = await restoreCarryingSwitches(actor, dest, tenantId, scopeId, dump, {
+            const restored = await restoreCarryingSwitches(c.var.admin, actor, dest, tenantId, scopeId, dump, {
                 scopeId, exact: true, loadStamp: restoredStamp,
                 ...(moveId ? { fence: copyRestoreFence(moveId, recordedAt, copyLeaseMs, erasureEpoch) } : {}),
             });
@@ -3749,7 +3766,7 @@ export function createControlPlaneApi(options) {
                 throw new ControlPlaneError(412, `the copy of scope ${scope.id} in '${from}' was already carried to another script and wiped, so nothing ` +
                     `was moved or bound (#1722). Reload the scope and retry.`);
             }
-            const restored = await restoreCarryingSwitches(actor, dest, scope.tenantId, scope.id, dump, {
+            const restored = await restoreCarryingSwitches(c.var.admin, actor, dest, scope.tenantId, scope.id, dump, {
                 scopeId: scope.id,
                 exact: true,
                 loadStamp: restoredStamp,
@@ -4116,7 +4133,7 @@ export function createControlPlaneApi(options) {
                 await c.var.admin.recordScopeScriptCopy(actor, scope.tenantId, scope.id, carried.to, recarryId, { role: 'destination', loadStamp: restoredStamp, leaseMs: copyLeaseMs });
                 try {
                     const erasureEpoch = await c.var.admin.scopeErasureEpoch(actor, scope.tenantId, scope.id);
-                    await restoreCarryingSwitches(actor, carried.dest, scope.tenantId, scope.id, dump, {
+                    await restoreCarryingSwitches(c.var.admin, actor, carried.dest, scope.tenantId, scope.id, dump, {
                         scopeId: scope.id,
                         exact: true,
                         loadStamp: restoredStamp,
@@ -4282,13 +4299,13 @@ export function createControlPlaneApi(options) {
         const p = c.get('principal');
         const scopePin = confinedTenant(p);
         if (scopePin) {
-            const v = scope.vertical ? await verticalOf(actor, scope.vertical) : undefined;
+            const v = scope.vertical ? await verticalOf(c.var.admin, actor, scope.vertical) : undefined;
             if (!v || v.ownerTenant !== scopePin)
                 return refuse(c, 'forbidden', 'forbidden');
         }
         const reached = await deploymentForScope(c, scope);
         if (!reached)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(c.get('actor'), scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, c.get('actor'), scope));
         const vertical = reached.client;
         const entitlements = await c.var.admin.listEntitlements(actor, tenantId);
         // #406: re-gathered and re-delivered like entitlements, so a reconcile also repairs a
@@ -4831,7 +4848,7 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(c.get('actor'), scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, c.get('actor'), scope));
         try {
             return c.json(await vertical.ownerSeat(tenantId, scopeId));
         }
@@ -4867,7 +4884,7 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(actor, scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, actor, scope));
         const origin = await instanceOrigin(c.var.admin, actor, scopeId);
         if (!origin) {
             return refuse(c, 'conflict', `scope ${scopeId} has no hostname bound — a claim link needs an address to open on`);
@@ -4908,7 +4925,7 @@ export function createControlPlaneApi(options) {
             return { refusal: refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`) };
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return { refusal: refuseStatus(c, 501, await diagnoseUnboundScope(actor, scope)) };
+            return { refusal: refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, actor, scope)) };
         return { tenantId, scopeId, actor, vertical, person: memberPerson(principal) };
     };
     /**
@@ -5028,7 +5045,7 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(actor, scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, actor, scope));
         const operationId = ulid();
         // An abandon (`abandon: true`) is audited the same way, every row marked, so the log tells
         // a hand-over closed without finishing from one that finished.
@@ -5064,7 +5081,7 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'not_found', `unknown scope for tenant: (${tenantId}, ${scopeId})`);
         const vertical = await verticalForScope(c, scope);
         if (!vertical) {
-            return refuseStatus(c, 501, await diagnoseUnboundScope(c.get('actor'), scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, c.get('actor'), scope));
         }
         try {
             await vertical.configureInstance({ tenantId, scopeId, entries: input.entries });
@@ -5217,12 +5234,17 @@ export function createControlPlaneApi(options) {
             }
             await retryTransient(() => copier.snapshotScope({ sourceScopeId: scope.id, newScopeId: snapId, tenantId }));
             // The scope file was copied inside the script. The store objects are per scope, so the
-            // fork gets its own copy through the reserved export and import, signed by the
-            // control plane. A version that declares no stores has nothing to copy.
+            // fork gets its own copy, page by page from the source's store into a stage at the fork's,
+            // signed by the control plane (D-69); every store is staged before any is committed. A
+            // version that declares no stores has nothing to copy.
             if (reach) {
-                const stores = await reach.caller.exportStores({ tenantId, scopeId: scope.id, vertical: reach.vertical, stores: reach.stores });
-                if (stores.length > 0) {
-                    await reach.caller.importStores({ tenantId, scopeId: snapId, vertical: reach.vertical, stores });
+                const from = { tenantId, scopeId: scope.id, vertical: reach.vertical };
+                const to = { ...from, scopeId: snapId };
+                const moved = await moveStores(snapshotEnds(reach.caller, from, to), reach.stores, `scope ${scope.id}'s stores`, options.storeMoveBudget);
+                try {
+                    await commitStages(reach.caller, to, moved, retryTransient);
+                }
+                finally {
                     replay = await replayPlatformStoreErasures(c, { ...scope, id: snapId }, scope.id);
                 }
             }
@@ -5404,9 +5426,11 @@ export function createControlPlaneApi(options) {
         const { tables: hostTables, ...header } = await c.var.admin.exportScope(c.get('actor'), tenantId, scope.id);
         const vertical = await verticalForScope(c, scope);
         // Store tables are opaque and stay unsealed. The platform reads them from the store script
-        // (#2207); a store it cannot name or reach refuses the backup rather than omitting it.
-        const stores = (await exportPlatformStores(c, scope)) ?? header.stores;
-        const backup = backupStage(store.begin({ vertical: scope.vertical, header: { ...header, stores } }), sealerFor(c, tenantId, scope.id));
+        // (#2207), a page at a time into entries of their own (D-69); a store it cannot name or reach
+        // refuses the backup rather than omitting it. Resolved before anything is written.
+        const reach = await platformStoreReach(c, scope);
+        const writer = store.begin({ vertical: scope.vertical, header: { ...header, stores: reach ? [] : header.stores } });
+        const backup = backupStage(writer, sealerFor(c, tenantId, scope.id));
         // #2839: from a vertical, the data moves into the store a page at a time, as a paged copy
         // moves it into another scope (#2450): captured, so a scope taking writes meanwhile is still
         // copied as it was at one moment, and never held whole here. A deployment that predates
@@ -5416,11 +5440,18 @@ export function createControlPlaneApi(options) {
             : hostTables;
         if (Array.isArray(moved))
             await backup.dest.stageScopePage(scope.id, ulid(), 0, moved);
+        // The scope, then its stores: two objects, so not one moment (D-69, question 3).
+        let stores = [];
         try {
-            return await backup.commit();
+            if (reach) {
+                stores = await moveStores(backupEnds(reach.caller, reach.place, writer), reach.stores, `scope ${scope.id}'s stores`, options.storeMoveBudget);
+            }
+            return await backup.commit(stores.map((s) => ({ binding: s.binding, driver: s.driver, stageId: s.moveId, entries: s.pages, revision: s.revision })));
         }
         catch (e) {
             await backup.discard();
+            for (const s of stores)
+                await writer.discard(s.moveId).catch(() => undefined);
             throw e;
         }
     };
@@ -5459,7 +5490,7 @@ export function createControlPlaneApi(options) {
                 },
                 discardStagedScope: (_, stageId) => writer.discard(stageId),
             },
-            commit: () => writer.commit({ stageId: last.stageId, entries: last.entries, tables: last.tables.size }),
+            commit: (storeEntries) => writer.commit({ stageId: last.stageId, entries: last.entries, tables: last.tables.size, storeEntries }),
             discard: () => writer.discard(last.stageId),
         };
     };
@@ -5499,6 +5530,16 @@ export function createControlPlaneApi(options) {
         if (held.entries > 1) {
             return refuseStatus(c, 413, `backup ${capturedAt} of scope ${scopeId} is stored in ${held.entries} entries (its pages, and any writes caught while it was taken), which only a restore applies; restore it with POST /tenants/${tenantId}/scopes/${scopeId}/backups/${capturedAt}/restore`);
         }
+        // A store held in one page is served inline, as `stores` always was; one held in more is a
+        // restore's to apply (D-69), so the backup is refused whole rather than handed back in part.
+        const paged = held.storeEntries.find((store) => store.entries > 1);
+        if (paged) {
+            return refuseStatus(c, 413, `backup ${capturedAt} of scope ${scopeId} holds scope store '${paged.binding}' in ${paged.entries} pages, which only a restore applies; restore it with POST /tenants/${tenantId}/scopes/${scopeId}/backups/${capturedAt}/restore`);
+        }
+        const pagedStores = [];
+        for (const store of held.storeEntries) {
+            pagedStores.push({ binding: store.binding, driver: store.driver, tables: mergeDumpPages([await held.storePage(store, 0)]) });
+        }
         const { tables } = await held.entry(0);
         // Unseal on the way out (#37). The bytes in the store stay sealed — this is the
         // authorized read opening them with the keys the platform holds. A subject shredded
@@ -5506,7 +5547,7 @@ export function createControlPlaneApi(options) {
         // working: the ciphertext never left the object, and nothing turns it back into a
         // person. A dump taken before sealing existed passes through untouched.
         const opened = await openDump(mergeDumpPages([tables]), sealerFor(c, tenantId, scopeId));
-        return c.json({ ...held.header, tables: opened });
+        return c.json({ ...held.header, stores: [...held.header.stores, ...pagedStores], tables: opened });
     });
     // Take a backup WITHOUT reaping — the standalone copy (a pre-migration checkpoint, an
     // export-to-keep). The reap route below takes its own; this is the same act made
@@ -5917,7 +5958,7 @@ export function createControlPlaneApi(options) {
         }
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
-            return refuseStatus(c, 501, await diagnoseUnboundScope(actor, scope));
+            return refuseStatus(c, 501, await diagnoseUnboundScope(c.var.admin, actor, scope));
         const { cleared } = await vertical.clearCopyMark(scopeId, { kind: scope.kind, forkedFrom: scope.forkedFrom });
         await c.var.admin.recordCopyMark(actor, { action: 'clear', tenantId, scopeId, outcome: cleared ? 'cleared' : 'absent' });
         return c.json({ cleared });
@@ -6381,9 +6422,15 @@ export function createControlPlaneApi(options) {
         if (!held)
             return refuse(c, 'not_found', `no backup for scope ${scopeId} at ${capturedAt}`);
         const { header } = held;
+        // A backup taken since D-69 holds its stores as store pages; one taken before, inline in its header.
+        const pagedStores = held.storeEntries.map((entry) => ({
+            binding: entry.binding,
+            driver: entry.driver,
+            source: { pages: entry.entries, revision: entry.revision, page: (seq) => held.storePage(entry, seq) },
+        }));
         if (options.platformScopeStores) {
             try {
-                await refuseUndeclaredDumpStores(c, scope, header.stores);
+                await refuseUndeclaredDumpStores(c, scope, [...header.stores, ...pagedStores]);
             }
             catch (e) {
                 if (e instanceof ControlPlaneError)
@@ -6398,7 +6445,7 @@ export function createControlPlaneApi(options) {
                 if (tables.length === 0) {
                     return refuseStatus(c, 422, 'restore refused: the backup has no tables — not a scope dump');
                 }
-                return c.json(await loadIntoScope(c, scope, { header, tables: await openDump(mergeDumpPages([tables]), sealer) }));
+                return c.json(await loadIntoScope(c, scope, { header, tables: await openDump(mergeDumpPages([tables]), sealer), pagedStores }));
             }
             // The host judges the roles the backup seats or defines before anything is replaced (#2555), and
             // records the tables it restores. So it is handed every table's schema and the role tables' rows,
@@ -6432,7 +6479,7 @@ export function createControlPlaneApi(options) {
                 }
                 return { dump: { stageId }, tables: judged.tables() };
             };
-            return c.json(await loadIntoScope(c, scope, { header, tables: [], stage }));
+            return c.json(await loadIntoScope(c, scope, { header, tables: [], stage, pagedStores }));
         }
         catch (e) {
             return restoreFailed(c, scope, e);
@@ -6461,32 +6508,55 @@ export function createControlPlaneApi(options) {
         // #2185: cleared before the load as well as after it (below): a step after the load can still
         // throw (the deployment's half, the re-assert), and the data that landed may predate a reconcile.
         await c.var.admin.markScopeProvisioned(actor, tenantId, scopeId, null);
-        const staged = input.stage && vertical ? await input.stage(vertical) : undefined;
-        const tables = staged?.tables ?? input.tables;
+        // D-69: every store is staged first, then the scope is loaded, then the stores are committed,
+        // then erasures are replayed. Until the first commit nothing of a store has changed, so a page
+        // that cannot be read, a refused stage or a refused load leaves every store as it was. Once a
+        // commit was attempted the replay runs whatever follows, and a restore run again converges.
+        const storesCaller = options.platformScopeStores;
+        const platform = storesCaller && vertical && scope.vertical
+            ? { caller: storesCaller, place: { tenantId, scopeId, vertical: scope.vertical } }
+            : undefined;
+        const pagedStores = input.pagedStores ?? [];
+        if (!platform && pagedStores.length > 0) {
+            throw new ControlPlaneError(409, `the backup holds scope stores in pages, and scope ${scopeId} has no deployment and no route to its stores to load them into`);
+        }
+        // With a route to the stores, an inline store moves as a paged one does; without one the host carries it.
+        const stores = platform ? [...inlineStoreSources(header.stores), ...pagedStores] : [];
+        const sources = new Map(stores.map((store) => [store.binding, store.source]));
+        const storeEnds = platform && restoreEnds(platform.caller, platform.place, (binding) => sources.get(binding));
+        const movedStores = storeEnds && stores.length > 0
+            ? await moveStores(storeEnds, stores.map(({ binding, driver }) => ({ binding, driver })), `the backup's stores for scope ${scopeId}`, options.storeMoveBudget)
+            : [];
+        let staged;
+        let committing = false;
         try {
-            const storesCaller = options.platformScopeStores;
-            const landing = { ...header, tables, stores: storesCaller && vertical ? [] : header.stores };
+            staged = input.stage && vertical ? await input.stage(vertical) : undefined;
+            const tables = staged?.tables ?? input.tables;
+            const landing = { ...header, tables, stores: platform ? [] : header.stores };
             const hostReplay = await c.var.host.restoreScope(actor, tenantId, scopeId, landing, sourceHint ? { sourceScopeId: sourceHint } : undefined);
-            if (storesCaller && vertical && scope.vertical && header.stores.length > 0) {
-                await storesCaller.importStores({
-                    tenantId,
-                    scopeId,
-                    vertical: scope.vertical,
-                    stores: header.stores,
-                });
-            }
-            const platformReplay = storesCaller && scope.vertical
-                ? await replayPlatformStoreErasures(c, scope, sourceHint ?? origin)
-                : undefined;
-            const replays = [hostReplay, platformReplay].filter((r) => !!r);
             // #1742: the recorded OFF positions ride the restore, so the deployment switches them
             // off in the replay's own event — its own sweeper cannot land in between.
             const restored = vertical
-                ? await restoreCarryingSwitches(actor, vertical, tenantId, scopeId, staged?.dump ?? tables, {
+                ? await restoreCarryingSwitches(c.var.admin, actor, vertical, tenantId, scopeId, staged?.dump ?? tables, {
                     scopeId: sourceHint ?? origin,
                     exact: false,
                 })
                 : undefined;
+            let landFailure;
+            if (platform && movedStores.length > 0) {
+                committing = true;
+                await commitStages(platform.caller, platform.place, movedStores, retryTransient).catch((e) => {
+                    if (!(e instanceof StoreLandFailure))
+                        throw e;
+                    landFailure = e;
+                });
+            }
+            const platformReplay = storesCaller && scope.vertical
+                ? await replayPlatformStoreErasures(c, scope, sourceHint ?? origin)
+                : undefined;
+            if (landFailure)
+                throw landFailure;
+            const replays = [hostReplay, platformReplay].filter((r) => !!r);
             // #1674: a backup from before a module was switched off brings it back on; the
             // directory's record puts it back off now, not at the next reconcile. Where the
             // deployment already did (#1742), this finds it done and audits what it reported.
@@ -6506,12 +6576,17 @@ export function createControlPlaneApi(options) {
             };
         }
         catch (e) {
-            // A stage the refused load left at the deployment goes now rather than waiting for a wipe.
+            // A stage the refused load left at the deployment goes now rather than waiting for a wipe,
+            // and so do the stores' stages, none of which was committed.
             if (staged && vertical)
                 await abandonCopy({ dest: vertical }, { from: scopeId, into: scopeId, stageId: staged.dump.stageId });
+            if (storeEnds && !committing)
+                await discardMoves(storeEnds, movedStores);
             throw e;
         }
     };
+    /** A dump's inline stores as restore sources, each cut at its driver's page size (D-69). */
+    const inlineStoreSources = (stores) => stores.map((store) => ({ binding: store.binding, driver: store.driver, source: inlineStoreSource(store) }));
     /** How a refused or failed restore answers, on either route. */
     const restoreFailed = async (c, scope, e) => {
         // #2185: and once more on the way out of a failure, for a sweep reconcile that wrote the
@@ -6633,11 +6708,11 @@ export function createControlPlaneApi(options) {
         const actor = c.get('actor');
         const adoptPin = confinedTenant(p);
         if (adoptPin) {
-            const v = await verticalOf(actor, slug);
+            const v = await verticalOf(c.var.admin, actor, slug);
             if (!v || v.ownerTenant !== adoptPin)
                 return refuse(c, 'forbidden', 'forbidden');
         }
-        const v = await verticalOf(actor, slug);
+        const v = await verticalOf(c.var.admin, actor, slug);
         if (!v)
             return refuse(c, 'not_found', `unknown vertical '${slug}'`);
         if (v.ownerTenant === null) {
@@ -6943,7 +7018,7 @@ export function createControlPlaneApi(options) {
             // #2185: before the load as well as after it, so a throw once the kept copy has landed (the
             // re-assert) cannot leave the receipt set over older data.
             await c.var.admin.markScopeProvisioned(actor, tenantId, scopeId, null);
-            const restored = await restoreCarryingSwitches(actor, live, tenantId, scopeId, dump, {
+            const restored = await restoreCarryingSwitches(c.var.admin, actor, live, tenantId, scopeId, dump, {
                 scopeId,
                 exact: true,
                 loadStamp: ulid(),
@@ -7010,7 +7085,7 @@ export function createControlPlaneApi(options) {
         // first (a version not admitted) the same way. An unknown scope has no impact to read, and
         // the bind below refuses it as it always has.
         if (scope)
-            await refuseOnBreaks(actor, tenantId, scopeId, versionId, { acknowledge });
+            await refuseOnBreaks(c.var.admin, actor, tenantId, scopeId, versionId, { acknowledge });
         // A refusal throws a ControlPlaneError, which the app's error boundary relays with its
         // status and records as an ops failure. An unknown scope carries nothing, and the bind
         // below refuses it as it always has.
@@ -7056,7 +7131,7 @@ export function createControlPlaneApi(options) {
                     try {
                         // Asked again after the carry: a promote landing since the first question would
                         // otherwise leave an archive behind for a bind the host then refuses.
-                        await refuseOnBreaks(actor, tenantId, scopeId, versionId, { acknowledge });
+                        await refuseOnBreaks(c.var.admin, actor, tenantId, scopeId, versionId, { acknowledge });
                         await orchestratedSnapshot(c, tenantId, scope, {});
                     }
                     catch (e) {
@@ -7252,14 +7327,14 @@ export function createControlPlaneApi(options) {
     // registry row's owner_tenant (undefined ⇒ not registered — a claimable slug).
     // `listVerticals` returns every row (the adapter does not narrow); the transport is
     // where per-principal filtering happens — here and on GET /verticals.
-    const ownerOf = async (actor, slug) => {
-        const v = (await host.admin.listVerticals(actor)).find((x) => x.slug === slug);
+    const ownerOf = async (admin, actor, slug) => {
+        const v = (await admin.listVerticals(actor)).find((x) => x.slug === slug);
         return v ? v.ownerTenant : undefined;
     };
     // The full registry row, for the checks that need more than the owner — whether the
     // vertical is PRIVATE (owned + not listed), which is what scopes a builder's prod
     // self-serve below.
-    const verticalOf = async (actor, slug) => (await host.admin.listVerticals(actor)).find((x) => x.slug === slug);
+    const verticalOf = async (admin, actor, slug) => (await admin.listVerticals(actor)).find((x) => x.slug === slug);
     /**
      * "This principal is confined, and this vertical is not its tenant's." The one
      * predicate every slug-addressed route asks.
@@ -7271,7 +7346,7 @@ export function createControlPlaneApi(options) {
      */
     const notOwned = async (p, slug) => {
         const pin = confinedTenant(p);
-        return pin !== null && (await ownerOf(p.actor, slug)) !== pin;
+        return pin !== null && (await ownerOf(adminFor(p), p.actor, slug)) !== pin;
     };
     /**
      * The READ twin of `notOwned`, for the routes an installed app's own pages ask
@@ -7284,7 +7359,7 @@ export function createControlPlaneApi(options) {
      * the prod history).
      */
     /** The bare slug of every registered vertical: what a manager's SKU may not be (#2388). */
-    const verticalSlugsOf = async (actor) => (await host.admin.listVerticals(actor)).map((v) => bareSlug(v.slug));
+    const verticalSlugsOf = async (admin, actor) => (await admin.listVerticals(actor)).map((v) => bareSlug(v.slug));
     /**
      * Whether a CONFINED principal may grant its own tenant `key` (#977): some vertical it
      * can read — its own, or a listed one — declares the key, or is the vertical whose
@@ -7299,8 +7374,8 @@ export function createControlPlaneApi(options) {
      * the first push). Its own slug and the engine keys are always declarable, so they reserve nothing.
      * Only a new slug is judged; the sentence names no other vertical.
      */
-    const slugClaimsSku = async (actor, slug) => {
-        const all = await host.admin.listVerticals(actor);
+    const slugClaimsSku = async (admin, actor, slug) => {
+        const all = await admin.listVerticals(actor);
         if (all.some((v) => v.slug === slug))
             return undefined;
         const name = bareSlug(slug);
@@ -7317,7 +7392,7 @@ export function createControlPlaneApi(options) {
         const pin = confinedTenant(p);
         if (pin === null)
             return true;
-        const all = await host.admin.listVerticals(p.actor);
+        const all = await adminFor(p).listVerticals(p.actor);
         const slugs = all.map((v) => bareSlug(v.slug));
         const visible = all.filter((v) => v.ownerTenant === pin || v.listed);
         return visible.some((v) => {
@@ -7331,7 +7406,7 @@ export function createControlPlaneApi(options) {
         const pin = confinedTenant(p);
         if (pin === null)
             return false;
-        const v = await verticalOf(p.actor, slug);
+        const v = await verticalOf(adminFor(p), p.actor, slug);
         return !v || (v.ownerTenant !== pin && !v.listed);
     };
     /**
@@ -7377,10 +7452,10 @@ export function createControlPlaneApi(options) {
         const workspace = (await c.var.admin.listTenants(actor)).find((t) => t.slug === pin || t.id === pin);
         if (!workspace || raw.startsWith(`${workspace.slug}/`))
             return raw;
-        if ((await ownerOf(actor, raw)) === workspace.id)
+        if ((await ownerOf(c.var.admin, actor, raw)) === workspace.id)
             return raw;
         const prefixed = `${workspace.slug}/${raw}`;
-        return (await ownerOf(actor, prefixed)) !== undefined ? prefixed : raw;
+        return (await ownerOf(c.var.admin, actor, prefixed)) !== undefined ? prefixed : raw;
     };
     app.get('/verticals', async (c) => {
         const page = pageParams(c);
@@ -7428,13 +7503,13 @@ export function createControlPlaneApi(options) {
      * same enumeration, and #977's observability narrowing must not be a second copy of
      * it that can drift when a third ref scheme appears.
      */
-    const tenantServiceRefs = async (actor, tenantId, slug) => {
-        const all = (await host.admin.listVerticals(actor)).filter((v) => v.ownerTenant === tenantId);
+    const tenantServiceRefs = async (admin, actor, tenantId, slug) => {
+        const all = (await admin.listVerticals(actor)).filter((v) => v.ownerTenant === tenantId);
         const considered = slug === undefined ? all : all.filter((v) => v.slug === slug);
         const verticalsTruncated = considered.length > MAX_SERVICE_REF_VERTICALS;
         const entries = [];
         for (const v of considered.slice(0, MAX_SERVICE_REF_VERTICALS)) {
-            const versions = await host.admin.listVersions(actor, v.slug);
+            const versions = await admin.listVersions(actor, v.slug);
             const labelOf = new Map(versions.map((ver) => [ver.id, ver.version]));
             // The stable serving script — where real traffic lands. Its version is the
             // registry row's own servingVersionId: authoritative, not the scope-derived
@@ -7474,7 +7549,7 @@ export function createControlPlaneApi(options) {
         const pin = confinedTenant(p);
         if (pin === null)
             return null;
-        const refs = await tenantServiceRefs(actor, pin);
+        const refs = await tenantServiceRefs(adminFor(p), actor, pin);
         if (refs.verticalsTruncated) {
             throw new ControlPlaneError(503, 'service map truncated: too many verticals to resolve in one answer');
         }
@@ -7493,7 +7568,7 @@ export function createControlPlaneApi(options) {
             .parse({ tenantId, vertical: c.req.query('vertical') });
         const actor = c.get('actor');
         const slug = query.vertical === undefined ? undefined : await resolveVerticalId(c, query.vertical);
-        const { entries, verticalsTruncated, matched } = await tenantServiceRefs(actor, query.tenantId, slug);
+        const { entries, verticalsTruncated, matched } = await tenantServiceRefs(c.var.admin, actor, query.tenantId, slug);
         // Non-ownership reads as absence (K-3), exactly like the per-slug registry reads.
         if (slug !== undefined && matched === 0)
             throw new ControlPlaneError(404, 'not found');
@@ -7508,17 +7583,17 @@ export function createControlPlaneApi(options) {
             // the prefix, backstopped by the ownership check). Owner + prefix come from the
             // principal, never trusted from the body.
             input.slug = effectiveSlug(p, input.slug);
-            const owner = await ownerOf(p.actor, input.slug);
+            const owner = await ownerOf(adminFor(p), p.actor, input.slug);
             if (owner !== undefined && owner !== p.tenantId)
                 return refuse(c, 'forbidden', 'forbidden');
             input.ownerTenant = p.tenantId;
         }
-        const claimed = await slugClaimsSku(c.get('actor'), input.slug);
+        const claimed = await slugClaimsSku(c.var.admin, c.get('actor'), input.slug);
         if (claimed)
             return refuseStatus(c, 422, claimed);
         // #2388: the same declaration rule as a push, for any principal that is not staff.
         if (p.kind !== 'staff') {
-            const foreignKey = entitlementNamespaceRefusal(input.slug, input.entitlements ?? [], input.provisions?.length ? await verticalSlugsOf(c.get('actor')) : undefined);
+            const foreignKey = entitlementNamespaceRefusal(input.slug, input.entitlements ?? [], input.provisions?.length ? await verticalSlugsOf(c.var.admin, c.get('actor')) : undefined);
             if (foreignKey)
                 return refuseStatus(c, 422, foreignKey);
         }
@@ -7606,7 +7681,7 @@ export function createControlPlaneApi(options) {
         // (backup, wipe, erasure, the meter), so its store scripts are put in place first, as a push
         // does: a driver with no approved release refuses here, and nothing is published. The publish is
         // made under the push's shared hold (#2816), so a rollout walks this vertical or waits for it.
-        await ensureScopeStoresOf(c.get('actor'), 'deploy', slug, scopeStores, async () => (await ownerOf(c.get('actor'), slug)) ?? null, async (renew) => {
+        await ensureScopeStoresOf(c.var.admin, c.get('actor'), 'deploy', slug, scopeStores, async () => (await ownerOf(c.var.admin, c.get('actor'), slug)) ?? null, async (renew) => {
             await renew();
             await c.var.admin.publishVersion(c.get('actor'), input);
         });
@@ -7827,7 +7902,7 @@ export function createControlPlaneApi(options) {
         const slug = c.req.param('slug');
         if (await notOwned(c.get('principal'), slug))
             return refuse(c, 'forbidden', 'forbidden');
-        const vertical = await verticalOf(c.get('actor'), slug);
+        const vertical = await verticalOf(c.var.admin, c.get('actor'), slug);
         if (!vertical)
             return refuse(c, 'not_found', 'vertical not found');
         return c.json({ slug, emailSender: !!vertical.emailSender });
@@ -7913,7 +7988,7 @@ export function createControlPlaneApi(options) {
      * (409) once one has lapsed; `then` calls it right before it records. A failure in `then` is not
      * recorded here: it is the caller's to answer.
      */
-    const ensureScopeStoresOf = async (actor, operation, slug, stores, owner, then = async () => undefined) => {
+    const ensureScopeStoresOf = async (admin, actor, operation, slug, stores, owner, then = async () => undefined) => {
         if (stores.length === 0)
             return then(async () => undefined);
         // D-67: a driver whose registration names its verticals serves those only, refused before any
@@ -7929,7 +8004,7 @@ export function createControlPlaneApi(options) {
         const held = [];
         const renewHolds = async (when) => {
             for (const each of held) {
-                if (!(await host.admin.holdStoreDriver(actor, { driver: each, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS, renew: true }))) {
+                if (!(await admin.holdStoreDriver(actor, { driver: each, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS, renew: true }))) {
                     throw new ControlPlaneError(409, `${operation} refused: the hold on scope store driver '${each}' lapsed ${when}; try again`);
                 }
             }
@@ -7944,13 +8019,13 @@ export function createControlPlaneApi(options) {
                 // a script's release before a rollout moved it would upload the old release back over it.
                 // Neither the refusal nor anything else here names another vertical: a push answers its own.
                 for (const driver of drivers) {
-                    if (!(await host.admin.holdStoreDriver(actor, { driver, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS }))) {
+                    if (!(await admin.holdStoreDriver(actor, { driver, holder, mode: 'shared', ttlMs: PUSH_HOLD_TTL_MS }))) {
                         throw new ControlPlaneError(409, `${operation} refused: scope store driver '${driver}' is being rolled out; try again in a few minutes`);
                     }
                     held.push(driver);
                 }
                 const loadRelease = options.storeReleases
-                    ? storedReleaseLoader({ admin: host.admin, actor, bytes: options.storeReleases.bytes })
+                    ? storedReleaseLoader({ admin, actor, bytes: options.storeReleases.bytes })
                     : async () => undefined;
                 // One driver at a time, each renewing every hold first: a push whose uploads outlast a hold
                 // stops (409) rather than upload after a rollout could have taken the driver.
@@ -7961,7 +8036,7 @@ export function createControlPlaneApi(options) {
                         throw new ControlPlaneError(403, `scope store driver '${driver}' is not registered`);
                     // Read under the shared hold (D-65): a revoke takes the driver exclusively, so one written
                     // before this read is seen, and none is written until this upload is done.
-                    const approvals = await readStoreDriverApprovals(host.admin, actor, registration);
+                    const approvals = await readStoreDriverApprovals(admin, actor, registration);
                     await options.ensureScopeStores({ vertical: slug, stores: stores.filter((store) => store.driver === driver), loadRelease, approvals });
                 }
             }
@@ -7981,7 +8056,7 @@ export function createControlPlaneApi(options) {
         }
         finally {
             for (const driver of held)
-                await host.admin.releaseStoreDriverHold(actor, { driver, holder }).catch(() => undefined);
+                await admin.releaseStoreDriverHold(actor, { driver, holder }).catch(() => undefined);
         }
     };
     /**
@@ -8086,12 +8161,12 @@ export function createControlPlaneApi(options) {
     const serveVersionInPlace = async (admin, actor, slug, versionId) => {
         if (!options.deployVertical || !options.fetchVerticalModules)
             return; // not configured: pre-#286 behavior
-        const version = await host.admin.getVersion(actor, versionId, slug);
+        const version = await admin.getVersion(actor, versionId, slug);
         if (!version?.deploymentRef) {
             throw new ControlPlaneError(502, `version ${versionId} has no archive script to serve from`);
         }
         const archiveRef = version.deploymentRef;
-        const manifestJson = await host.admin.versionManifest(actor, slug, versionId);
+        const manifestJson = await admin.versionManifest(actor, slug, versionId);
         if (!manifestJson) {
             throw new ControlPlaneError(502, `version ${versionId} retained no manifest — pushed pre-#286; push it again to serve in place`);
         }
@@ -8101,7 +8176,7 @@ export function createControlPlaneApi(options) {
         // serving record below all read this one set; the manifest's own `doClasses` would leave
         // the record a class short of the script, and the next serve re-declaring a live class.
         const doClasses = deployedDoClasses(manifest.doClasses, manifest.platformSweeper);
-        const serving = await host.admin.verticalServing(actor, slug);
+        const serving = await admin.verticalServing(actor, slug);
         const ref = serving?.ref ?? stableDeploymentRefFor(slug);
         // #1923: the serving upload is the other door a script name is minted through.
         const collision = platformScriptCollision(slug) ?? (PLATFORM_SCRIPT_NAMES.has(ref) ? ref : null);
@@ -8115,16 +8190,16 @@ export function createControlPlaneApi(options) {
         // tenant's store. Platform-granted after the §4 sandbox check, like injectSecrets:
         // the builder never declared these and never named the ids.
         const storeBindings = [
-            ...tenantStoreBindings(await host.admin.listTenantStores(actor, { vertical: slug })),
+            ...tenantStoreBindings(await admin.listTenantStores(actor, { vertical: slug })),
             // #473: the per-tenant blob-store r2_bucket bindings, re-derived from the ledger on
             // every serving upload for the same reason — an upload replaces the script's binding
             // set, so a re-deploy must never drop a tenant's attachment bucket.
-            ...blobStoreBindings(await host.admin.listBlobStores(actor, { vertical: slug })),
+            ...blobStoreBindings(await admin.listBlobStores(actor, { vertical: slug })),
         ].map((b) => b.type === 'd1'
             ? { type: 'd1', name: b.name, id: b.id }
             : { type: 'r2_bucket', name: b.name, bucket_name: b.bucketName });
         // #2210: the store scripts first, so the vertical is never served before what it reaches.
-        await ensureScopeStoresOf(actor, 'serve', slug, manifest.scopeStores, async () => (await ownerOf(actor, slug)) ?? null);
+        await ensureScopeStoresOf(admin, actor, 'serve', slug, manifest.scopeStores, async () => (await ownerOf(admin, actor, slug)) ?? null);
         const wire = await deployVerticalScript(options.deployVertical, actor, slug, ref, {
             entry: manifest.entry,
             compatibilityDate: manifest.compatibilityDate,
@@ -8286,14 +8361,14 @@ export function createControlPlaneApi(options) {
         if (!options.deployVertical || !options.fetchVerticalModules)
             return none; // no in-place serve moves anything
         const actor = c.get('actor');
-        const incoming = await host.admin.getVersion(actor, versionId, slug);
+        const incoming = await c.var.admin.getVersion(actor, versionId, slug);
         if (!incoming?.deploymentRef)
             return none;
-        const manifestJson = await host.admin.versionManifest(actor, slug, versionId);
+        const manifestJson = await c.var.admin.versionManifest(actor, slug, versionId);
         const registry = manifestJson ? storedDeployManifest.parse(JSON.parse(manifestJson)).registry : undefined;
         if (!registry || !releaseRolesAskScopes(registry))
             return none;
-        const v = await verticalOf(actor, slug);
+        const v = await verticalOf(c.var.admin, actor, slug);
         const owner = v && v.ownerTenant !== null && !v.listed ? v.ownerTenant : null;
         const moved = (await c.var.admin.listScopes(actor, { vertical: slug, status: ['active', 'suspended'] }))
             .filter((s) => !s.forkedFrom && s.kind !== 'preview' && (!!s.servingRef || (s.tenantId === owner && s.status === 'active')))
@@ -8347,23 +8422,23 @@ export function createControlPlaneApi(options) {
      * Over-approximates for a host that cannot serve in place, where no adopt runs: an extra line
      * costs a read, a missing one a silent stall.
      */
-    const promoteImpactOf = async (actor, slug, channel, versionId) => {
-        const gate = await host.admin.promotionImpact(actor, slug, channel, versionId);
+    const promoteImpactOf = async (admin, actor, slug, channel, versionId) => {
+        const gate = await admin.promotionImpact(actor, slug, channel, versionId);
         if (channel !== 'prod')
             return gate;
-        const v = await verticalOf(actor, slug);
+        const v = await verticalOf(admin, actor, slug);
         if (!v || v.ownerTenant === null || v.listed)
             return gate;
-        const incoming = await host.admin.getVersion(actor, versionId, slug);
+        const incoming = await admin.getVersion(actor, versionId, slug);
         if (!incoming?.deploymentRef || incoming.admission !== 'admitted')
             return gate;
-        const lagging = (await host.admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && !s.servingRef && s.verticalVersionId !== versionId);
+        const lagging = (await admin.listScopes(actor, { tenantId: v.ownerTenant, vertical: slug, status: ['active'] })).filter((s) => !s.forkedFrom && s.kind !== 'preview' && !s.servingRef && s.verticalVersionId !== versionId);
         const seen = new Set(gate.map((b) => `${b.scopeId}|${b.type}`));
         const out = [...gate];
         for (const s of lagging) {
             // After the adopt it runs the promoted version, served in place: that pointer move, from
             // what it runs now, is the move to judge.
-            for (const b of await host.admin.bindingImpact(actor, s.tenantId, s.id, versionId)) {
+            for (const b of await admin.bindingImpact(actor, s.tenantId, s.id, versionId)) {
                 const key = `${b.scopeId}|${b.type}`;
                 if (!seen.has(key))
                     (seen.add(key), out.push(b));
@@ -8382,11 +8457,11 @@ export function createControlPlaneApi(options) {
         const versionId = z.string().min(1).parse(c.req.query('versionId'));
         const pin = confinedTenant(p);
         if (pin) {
-            const v = await verticalOf(p.actor, slug);
+            const v = await verticalOf(adminFor(p), p.actor, slug);
             if (!v || v.ownerTenant !== pin)
                 return refuse(c, 'forbidden', 'forbidden');
         }
-        const breaks = await promoteImpactOf(c.get('actor'), slug, channel, versionId);
+        const breaks = await promoteImpactOf(c.var.admin, c.get('actor'), slug, channel, versionId);
         const { visible, otherTenants } = narrowToCaller(breaks, pin);
         return c.json({ affected: visible, ...(otherTenants ? { otherTenants } : {}) });
     });
@@ -8404,7 +8479,7 @@ export function createControlPlaneApi(options) {
         const promotePin = confinedTenant(p);
         if (promotePin) {
             // A confined principal promotes only verticals its tenant owns.
-            const v = await verticalOf(p.actor, slug);
+            const v = await verticalOf(adminFor(p), p.actor, slug);
             if (!v || v.ownerTenant !== promotePin)
                 return refuse(c, 'forbidden', 'forbidden');
             // …and a BUILDER promotes prod only while the vertical is PRIVATE (not listed).
@@ -8438,7 +8513,7 @@ export function createControlPlaneApi(options) {
         // counts only the gate's half of them.
         let counted = [];
         const breaksOf = async () => {
-            const breaks = await promoteImpactOf(c.get('actor'), slug, channel, versionId);
+            const breaks = await promoteImpactOf(c.var.admin, c.get('actor'), slug, channel, versionId);
             counted = breaks;
             if (breaks.length === 0)
                 return null;
@@ -8609,9 +8684,9 @@ export function createControlPlaneApi(options) {
         if (c.req.method === 'POST') {
             const input = z.object({ slug: z.string().min(1), name: z.string().min(1), repository: z.unknown().optional() }).parse(await c.req.json());
             const team = tenants.find((t) => t.id === tenant);
-            const slug = await ownerOf(c.get('actor'), input.slug) === tenant || input.slug.startsWith(`${team.slug}/`) ? input.slug : `${team.slug}/${input.slug}`;
+            const slug = await ownerOf(c.var.admin, c.get('actor'), input.slug) === tenant || input.slug.startsWith(`${team.slug}/`) ? input.slug : `${team.slug}/${input.slug}`;
             verticalSlug.parse(slug);
-            const owner = await ownerOf(c.get('actor'), slug);
+            const owner = await ownerOf(c.var.admin, c.get('actor'), slug);
             if (owner !== undefined && owner !== tenant)
                 return refuse(c, 'forbidden', 'forbidden');
             body = JSON.stringify({ ...input, slug });
@@ -8666,9 +8741,9 @@ export function createControlPlaneApi(options) {
                 if (!tenant)
                     return refuse(c, 'not_found', 'unknown workspace');
                 sourceTenant = tenant.id;
-                sourceSlug = bare.startsWith(`${tenant.slug}/`) || await ownerOf(c.get('actor'), bare) === tenant.id ? bare : `${tenant.slug}/${bare}`;
+                sourceSlug = bare.startsWith(`${tenant.slug}/`) || await ownerOf(c.var.admin, c.get('actor'), bare) === tenant.id ? bare : `${tenant.slug}/${bare}`;
             }
-            const owner = await ownerOf(c.get('actor'), sourceSlug);
+            const owner = await ownerOf(c.var.admin, c.get('actor'), sourceSlug);
             if (sourceTenant && owner !== undefined && owner !== sourceTenant)
                 return refuse(c, 'forbidden', 'forbidden');
             sourceTenant ??= owner ?? null;
@@ -8760,7 +8835,7 @@ export function createControlPlaneApi(options) {
             }
             slug = effectiveSlug(p, bare);
             // A builder pushes to a slug it owns, or claims an unregistered one (§3).
-            const existingOwner = await ownerOf(c.get('actor'), slug);
+            const existingOwner = await ownerOf(c.var.admin, c.get('actor'), slug);
             if (existingOwner !== undefined && existingOwner !== p.tenantId) {
                 return refuse(c, 'forbidden', 'forbidden');
             }
@@ -8774,9 +8849,9 @@ export function createControlPlaneApi(options) {
             // hand-registration predating prefixed claims) stays addressable as itself.
             // Otherwise the claim lands under the tenant prefix, exactly like a builder push —
             // same namespace, no claim race with other workspaces' bare names.
-            const bareOwner = await ownerOf(c.get('actor'), bare);
+            const bareOwner = await ownerOf(c.var.admin, c.get('actor'), bare);
             slug = bare.startsWith(`${workspace.slug}/`) || bareOwner === workspace.id ? bare : `${workspace.slug}/${bare}`;
-            const existingOwner = slug === bare ? bareOwner : await ownerOf(c.get('actor'), slug);
+            const existingOwner = slug === bare ? bareOwner : await ownerOf(c.var.admin, c.get('actor'), slug);
             if (existingOwner !== undefined && existingOwner !== workspace.id) {
                 return refuse(c, 'forbidden', `vertical '${slug}' is not owned by workspace '${pin}'`);
             }
@@ -8786,7 +8861,7 @@ export function createControlPlaneApi(options) {
             // No pin: the raw slug is the identity and an existing owner is preserved
             // (null ⇒ platform-owned for a first-party vertical) — unchanged staff behavior.
             slug = bare;
-            ownerTenant = (await ownerOf(c.get('actor'), slug)) ?? null;
+            ownerTenant = (await ownerOf(c.var.admin, c.get('actor'), slug)) ?? null;
         }
         // #1923: a slug that would deploy under one of the platform's own script names is refused
         // before anything is uploaded. Registration refuses it too; this is the deploy half, for a
@@ -8864,10 +8939,10 @@ export function createControlPlaneApi(options) {
         // is judged here and honoured by the grant paths only for a tenant-provisioner. Earlier versions
         // are not re-judged.
         // Declaring `provisions` marks a manager: the capability itself is granted after a first push.
-        const foreignKey = entitlementNamespaceRefusal(slug, manifest.entitlements ?? [], manifest.provisions?.length ? await verticalSlugsOf(c.get('actor')) : undefined);
+        const foreignKey = entitlementNamespaceRefusal(slug, manifest.entitlements ?? [], manifest.provisions?.length ? await verticalSlugsOf(c.var.admin, c.get('actor')) : undefined);
         if (foreignKey)
             return refuseStatus(c, 422, foreignKey);
-        const claimed = await slugClaimsSku(c.get('actor'), slug);
+        const claimed = await slugClaimsSku(c.var.admin, c.get('actor'), slug);
         if (claimed)
             return refuseStatus(c, 422, claimed);
         // The static-asset half of the §4 sandbox contract (self-serve-deploy.md §4.1). The
@@ -8938,7 +9013,7 @@ export function createControlPlaneApi(options) {
         // the publish run under the store push's shared hold (#2816): a rollout that starts before the
         // version records its stores is refused, and one after walks this vertical.
         const deployVertical = options.deployVertical;
-        const pushed = await ensureScopeStoresOf(c.get('actor'), 'deploy', slug, manifest.scopeStores, async () => ownerTenant ?? null, async (renew) => {
+        const pushed = await ensureScopeStoresOf(c.var.admin, c.get('actor'), 'deploy', slug, manifest.scopeStores, async () => ownerTenant ?? null, async (renew) => {
             let wire;
             try {
                 wire = await deployVerticalScript(deployVertical, c.get('actor'), slug, deploymentRef, {
@@ -9343,7 +9418,7 @@ export function createControlPlaneApi(options) {
             limit: c.req.query('limit'),
         });
         // #1877: scoped to the app's own scripts — the scan and trust boundary.
-        const services = await appServices(c.get('actor'), input.tenantId, input.scopeId, input.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), input.tenantId, input.scopeId, input.vertical);
         const { operation, principalKind, ...rest } = input;
         const { events, incomplete } = await options.observability.tenantLogs({
             ...rest,
@@ -9380,7 +9455,7 @@ export function createControlPlaneApi(options) {
         catch (e) {
             throw new ControlPlaneError(400, e.message);
         }
-        const scopes = await host.admin.listScopes(c.get('actor'), { tenantId: input.tenantId });
+        const scopes = await c.var.admin.listScopes(c.get('actor'), { tenantId: input.tenantId });
         const installed = scopes.find((s) => s.id === input.scopeId);
         if (!installed?.vertical)
             return refuse(c, 'not_found', 'app not found');
@@ -9420,7 +9495,7 @@ export function createControlPlaneApi(options) {
      * nothing. `listScopes`, not `getScopeRecord`: a dashboard read must not write an access
      * row per page view.
      */
-    const appServices = async (actor, tenantId, scopeId, vertical) => scriptFamiliesOfScopes(await host.admin.listScopes(actor, { tenantId: tenantIdSchema.parse(tenantId) }), { scopeId, vertical });
+    const appServices = async (admin, actor, tenantId, scopeId, vertical) => scriptFamiliesOfScopes(await admin.listScopes(actor, { tenantId: tenantIdSchema.parse(tenantId) }), { scopeId, vertical });
     app.get('/observability/tenant-request-volume', async (c) => {
         if (!options.observability?.tenantRequestVolume) {
             return refuseStatus(c, 501, 'request aggregation is not configured on this control plane');
@@ -9430,7 +9505,7 @@ export function createControlPlaneApi(options) {
         // A bucket COUNT: zooming in keeps it and narrows the window, so the bucket shrinks.
         // 90 is the design's histogram; the bounds keep a chart drawable and a query cheap.
         const buckets = z.coerce.number().int().min(10).max(240).default(90).parse(c.req.query('buckets'));
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantRequestVolume({ ...scope, services, buckets }));
     });
     app.get('/observability/tenant-request-facets', async (c) => {
@@ -9443,7 +9518,7 @@ export function createControlPlaneApi(options) {
         // that shows three asks for three.
         const asked = (c.req.queries('facet') ?? []).filter((k) => k.length > 0);
         const keys = asked.length === 0 ? undefined : z.array(z.enum(REQUEST_FACET_KEYS)).parse([...new Set(asked)]);
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantRequestFacets({ ...scope, services, ...(keys ? { keys } : {}) }));
     });
     // #1747: the tenant's `ctx.log` lines grouped by the template they were written from.
@@ -9472,7 +9547,7 @@ export function createControlPlaneApi(options) {
             buckets: narrow.buckets,
             ...(narrow.level.length ? { level: narrow.level } : {}),
             ...(narrow.operation.length ? { operation: narrow.operation } : {}),
-            services: await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical),
+            services: await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical),
         }));
     });
     // #2762: the Lines histogram and facets — a tenant's request lines and `ctx.log` lines, counted
@@ -9483,7 +9558,7 @@ export function createControlPlaneApi(options) {
         }
         const scope = parseTenantLineQuery(requestTenantOf(c), requestQueryOf(c));
         const buckets = z.coerce.number().int().min(10).max(240).default(90).parse(c.req.query('buckets'));
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantLogVolume({ ...scope, services, buckets }));
     });
     app.get('/observability/tenant-log-facets', async (c) => {
@@ -9491,7 +9566,7 @@ export function createControlPlaneApi(options) {
             return refuseStatus(c, 501, 'line aggregation is not configured on this control plane');
         }
         const scope = parseTenantLineQuery(requestTenantOf(c), requestQueryOf(c));
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantLogFacets({ ...scope, services }));
     });
     app.get('/observability/tenant-requests', async (c) => {
@@ -9500,7 +9575,7 @@ export function createControlPlaneApi(options) {
         }
         const scope = parseTenantRequestQuery(requestTenantOf(c), requestQueryOf(c));
         const limit = z.coerce.number().int().min(1).max(200).default(50).parse(c.req.query('limit'));
-        const services = await appServices(c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
+        const services = await appServices(c.var.admin, c.get('actor'), scope.tenantId, scope.scopeId, scope.vertical);
         return c.json(await options.observability.tenantRequests({ ...scope, services, limit }));
     });
     /**
@@ -9959,7 +10034,7 @@ export function createControlPlaneApi(options) {
         if (!parsed)
             throw new ControlPlaneError(400, `'${baseHostname}' is not a hostname a preview can be minted beside`);
         const hostname = withLabel(parsed, `${parsed.label}${RESERVED_LABEL_SEPARATOR}${tag}`);
-        const existing = (await host.admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
+        const existing = (await admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
         if (!existing) {
             await admin.bindHostname(actor, {
                 hostname,
@@ -9970,7 +10045,7 @@ export function createControlPlaneApi(options) {
                 canonical: false,
             });
         }
-        const bound = (await host.admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
+        const bound = (await admin.listHostnames(actor, { scopeId: previewId })).find((h) => h.hostname === hostname);
         if (bound)
             await runIssuance(admin, actor, bound); // platform mint rides the wildcard cert → active
         return hostname;
@@ -9979,9 +10054,9 @@ export function createControlPlaneApi(options) {
      *  source scope's canonical URL; a clean-room preview (no source, #509 ask (b)) has none,
      *  so it is built from the platform tenant-app convention `<vertical>-<tenant>.<base>` —
      *  the same scheme provisioning mints (`callout-sesamy.global.substrat.run`). */
-    const previewBaseHostname = async (actor, source, tenantId, slug, surface) => {
+    const previewBaseHostname = async (admin, actor, source, tenantId, slug, surface) => {
         if (source) {
-            const own = await host.admin.listHostnames(actor, { scopeId: source.id });
+            const own = await admin.listHostnames(actor, { scopeId: source.id });
             const src = own.find((h) => h.canonical && h.surface === surface) ??
                 own.find((h) => h.canonical) ??
                 own[0];
@@ -10003,7 +10078,7 @@ export function createControlPlaneApi(options) {
         // bare apex and stranded clean-room previews on a hostname that never resolves.
         const baseDomain = [...platformBaseDomains].sort((a, b) => a.length - b.length)[0];
         const jurisdiction = 'global';
-        const tenant = await host.admin.getTenant(actor, tenantId);
+        const tenant = await admin.getTenant(actor, tenantId);
         const handle = tenant?.slug ?? tenantId;
         return `${slug.split('/').at(-1)}-${handle}.${jurisdiction}.${baseDomain}`;
     };
@@ -10241,7 +10316,7 @@ export function createControlPlaneApi(options) {
             : [];
         // The `--<tag>` URL's base — the source's canonical hostname (fork) or the tenant-app
         // convention (clean-room). Computed once so reuse and fresh mint the same URL.
-        const baseHostname = await previewBaseHostname(actor, source, tenantId, slug, surface);
+        const baseHostname = await previewBaseHostname(c.var.admin, actor, source, tenantId, slug, surface);
         // The founding #559 case lands its durable row HERE, not in onError: the previews
         // route answers a ControlPlaneError directly (its own catch, never the app-level
         // recorder), and only this frame knows the preview's scopeId (`intoId`) — the key that lets
@@ -10807,7 +10882,7 @@ export function createControlPlaneApi(options) {
     const previewVertical = async (c) => {
         const p = c.get('principal');
         const slug = await resolveVerticalId(c, c.req.param('slug'));
-        const v = await verticalOf(c.get('actor'), slug);
+        const v = await verticalOf(c.var.admin, c.get('actor'), slug);
         if (!v)
             return { refused: 'not_found', error: `unknown vertical '${slug}'` };
         if (confinedTenant(p) !== null && v.ownerTenant !== confinedTenant(p)) {
@@ -11588,7 +11663,7 @@ export function createControlPlaneApi(options) {
             const workspace = (await c.var.admin.listTenants(c.get('actor'))).find((t) => t.slug === pin || t.id === pin);
             if (!workspace)
                 return refuse(c, 'not_found', `unknown workspace '${pin}'`);
-            const bareOwner = await ownerOf(c.get('actor'), vertical);
+            const bareOwner = await ownerOf(c.var.admin, c.get('actor'), vertical);
             id = vertical.startsWith(`${workspace.slug}/`) || bareOwner === workspace.id ? vertical : `${workspace.slug}/${vertical}`;
         }
         const drivers = (options.storeDrivers ?? STORE_DRIVERS).map((d) => d.verticals ? { ...d, verticals: storeDriverServesVertical(d, id) ? [vertical] : [] } : d);